Questions and answers.
A guide for owners of critical digital assets: how to tell whether your system is a CDA, how the audit works, what documents to prepare and what the liability for inaction is.
The answers are based on current requirements and the Digital Code of Kazakhstan. Exact deadlines and document formats are set by the authorised body — where they differ, follow the primary source.
What is a critical digital asset and how do I know if mine is one
Critical digital assets are digital systems and digital infrastructure facilities whose disruption threatens national security. The earlier term was “critical facilities of information and communication infrastructure”.
The list is set by the authorised body. If your organisation provides vital services — energy, transport, telecoms, finance, healthcare, government services — the likelihood of inclusion is high.
How certification works
The sequence: application → preliminary survey → documentation review → hands-on security testing → report and opinion → remediation of findings → re-check where required.
What documents to prepare
Organisational cybersecurity policy · inventory of digital systems and processed data · threat and attacker model · incident and personal data breach response procedure · digital infrastructure diagram · list of security controls · appointment records for responsible officers · access audit logs.
You can check your readiness in advance using the self-assessment checklists.
What are the deadlines
Specific deadlines are set by secondary legislation and depend on the category of the asset.
Note in particular: under the Digital Code, the deadline for reporting a personal data breach is measured in hours, not days. The response procedure must be written in advance — drafting it during an incident is too late.
What is the liability for non-compliance
The rule in force is Article 79 of the Administrative Code: up to 2,000 monthly calculation indices for personal data violations.
A multiple increase in fines and criminal liability for mass breaches are currently proposed amendments, not rules in force.
For the financial market, resolution No. 81 of the ARDFM board of 20 April 2026 introduced personal liability of the chief executive for information security — in force since 12 July 2026.
Who can carry out the audit
The institute provides assessment and compliance audit services, including personal data protection checks. You can submit a request via the enquiry form or read the terms in the “Assessment and consulting”.
What to do in the first 15 minutes after discovering unauthorised access
Record the exact time of discovery. Isolate the network segment without shutting down the system — powering off destroys the contents of memory along with the evidence. Preserve logs and memory images. Notify the responsible officer and the STS. Do nothing that destroys evidence: do not reinstall, do not clear logs, do not let antivirus “clean” anything before images are taken.
A detailed procedure is in the knowledge base.